CVE-2026-12193: VS Revo RevoUninstaller Kernel Driver Heap Buffer Overflow

Technical summary

The IOCtl_Handler function in RevoDetector.sys (the kernel-mode component of VS Revo RevoUninstaller) fails to properly validate or bound-check buffer sizes when processing IOCTL requests. This allows a local, low-privileged process to write beyond allocated heap memory boundaries. The attack surface is the driver's IOCTL interface, accessible to any authenticated user. The vulnerability maps to CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-122 (heap-based buffer overflow), classic memory safety issues common in kernel drivers written in languages without automatic bounds checking.

Business impact

RevoUninstaller is widely deployed as a software removal utility, particularly in enterprise environments managing end-user machines. Compromise of the kernel driver undermines the security of affected systems because: (1) code execution at kernel level bypasses user-mode access controls; (2) an attacker can persist across reboots or move laterally; (3) defender trust in the driver is broken, requiring immediate remediation across the fleet. For organizations with RevoUninstaller in their standard imaging or enterprise deployment, this represents a high-priority remediation to prevent privilege escalation attacks.

Affected systems

VS Revo RevoUninstaller versions 2.5.x and 2.6.x are vulnerable. The RevoDetector.sys driver is the affected component. Systems running earlier versions (2.4.x and below) or version 2.7.0+ are not affected. Any Windows system with RevoUninstaller 2.5.x or 2.6.x installed and the RevoDetector driver loaded is at risk.

Exploitability

Exploitability is high because: (1) a public exploit is available, meaning threat actors can leverage existing proof-of-concept code; (2) the attack requires only local access and standard user privileges—no administrator or SYSTEM context is needed; (3) the IOCTL interface is accessible from user-mode processes without special permissions; (4) no user interaction (clicking a link, opening a file) is required. The barrier to exploitation is low. The absence of CVSS social engineering factors (UI:N) reflects this. However, the attacker must be able to execute code locally, which typically assumes an initial foothold (e.g., malware infection, insider threat, or physical access).

Remediation

Update VS Revo RevoUninstaller to version 2.7.0 or later across all affected installations. This is a straightforward, single-version jump with no known breaking changes. Verify the upgrade completes and the RevoDetector driver version updates accordingly. Organizations deploying RevoUninstaller via system images or software distribution tools should refresh their baseline image and push the update through standard patch management processes.

Patch guidance

Obtain version 2.7.0 from the official VS Revo website or authorized distributor. Verify the version in Control Panel > Programs > Programs and Features (look for VS Revo RevoUninstaller version) or via command line (query the driver file version). Apply the update to all in-scope systems within your maintenance window. For enterprise deployments, consider bundling this update into your monthly or emergency patch cycle. Confirm post-update that RevoDetector.sys is loaded and functioning (e.g., via Device Manager or WMI queries for the driver). No rollback is necessary or recommended; version 2.7.0 is the fixed baseline.

Detection guidance

Monitor for IOCTL requests to RevoDetector.sys using tools such as Procmon (Process Monitor) to identify suspicious or repeated calls with unusually large buffer sizes. Endpoint Detection and Response (EDR) platforms can detect kernel driver exploitation attempts or unusual privilege escalation following RevoUninstaller activity. Look for error logs indicating driver crashes or memory protection violations (e.g., DEP/ASLR hits). Audit which systems currently have RevoUninstaller 2.5.x or 2.6.x installed using software inventory tools or WMI queries for installed products. Compare against your baseline to identify systems needing urgent update.

Why prioritize this

This vulnerability scores 7.8 (HIGH) and warrants immediate attention because: (1) public exploits exist, reducing time to weaponization; (2) kernel-mode code execution enables privilege escalation and full system compromise; (3) the attack requires only local access, a common post-breach scenario; (4) the fix is trivial (single version bump to 2.7.0); (5) RevoUninstaller is often overlooked in patch management, making the install base a soft target. Organizations should treat this as a priority remediation for the next 30 days, particularly if RevoUninstaller is part of standard deployment or if the system is internet-facing or multi-tenant.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (AV:L) — requires local code execution; Attack Complexity Low (AC:L) — no special conditions; Privileges Required Low (PR:L) — standard user context suffices; User Interaction None (UI:N) — no social engineering; Scope Unchanged (S:U) — impact is confined to the affected system; Confidentiality High (C:H), Integrity High (I:H), Availability High (A:H) — the attacker gains full read, write, and crash capabilities. The score lands in the HIGH band (7.0–8.9) rather than CRITICAL because the attack vector is local-only; a remote attack would be CRITICAL.

Frequently asked questions